one_gadget - The best tool for finding one gadget RCE in libc.s

项目说明

![Downloads]()

![Gem ]()
![Build Status]()
![Maintainability]()
![Code Co]()
![API Docs]()
![MIT License]()

OneGadget

When solving CTF pwn challenges we usually want a one-gadget RCE: a single address in
libc that, jumped to, calls execve("/bin/sh", NULL, NULL).

This gem finds them for you, so you don't have to dig through objdump or IDA Pro every
time :wink:

Point it at a libc -- one_gadget /path/to/libc -- and enjoy the magic :laughing:

Installation

A on RubyGems.org!

Supported Architectures

Implementation

OneGadget symbolically executes the code around each candidate address to work out what
has to hold for the gadget to work.

Gadgets are found by walking the control-flow graph backward from each exec/posix_spawn
call, following conditional branches both ways. When a gadget is only reachable if a branch is
(not) taken, that decision shows up as an extra constraint, e.g. x2 == 0x1.

The article introducing how I develop this tool can be found on my blog.

Checked by running them

Constraints are only worth as much as they are complete, so the gadgets this repository
ships are by being run. Aletheia loads the libc in a live
process, arranges exactly what a gadget's constraints ask for, poisons every register and
page they *don't* mention, jumps to the offset, and requires a real /bin/sh to come back
and list the root directory. A gadget whose constraint list is missing something fails
there instead of passing by luck -- which is how several missing constraints were found.

Aletheia is de tooling: it li lib/ and bin/, so it is not part of
the published gem.

Usage

Command Line Interface

!x86_64

#### Gi

!build id

The gem carries the gadgets of the libcs most likely to be asked for -- the glibc of
every Ubuntu LTS still in standard support, and every libc the tests cover. Any other
BuildID is fetched from this repository, which keeps them all.

#### Gadgets Near Functions

##### Why

Consider this situation while exploiting:
1. You can write to the GOT (Global Offset Table).
2. The base address of libc is *unknown*.

Here you can o the low two bytes of a GOT entry with the low two bytes of a
one-gadget. If the function sits close enough to the gadget, only one nibble is left to
guess -- at least a 1 in 16 chance of success.

##### Usage

Sorts the gadgets by how far they are from the functions you name.

!near

Regular expressions work too.

Pass an ELF file instead, and OneGadget uses every function in its GOT.

#### Show More Gadgets

A libc holds far more gadgets than fit on a screen, and most of them ask more of you
than a handful of others do. --level chooses how much of what was found to show.

| Level | Shows | Use it when |
| --- | --- | --- |
| 0 (default) | the few gadgets whose constraints are easiest to arrange | always, first |
| 1 | every gadget, one line per address, minus any that asks for e an easier one asks for and more | none of the level-0 gadgets fit what you control |
| 2 | e found, including an address listed once per set of constraints it can be reached under | you want to see every way in, including the awkward ones |

Level 1 drops a gadget when an easier one already asks for e it does; level 0
then scores what is left by how hard its constraints look and keeps only the best few;
level 2 drops nothing. On the glibc 2.31 below that is 4, 32 and 97 entries -- the last
over 96 addresses, since one of them is reachable two ways with different requirements.

Level 2 reads the libc you point at directly, where the levels below it answer from the
pre-built gadget database when it knows the file's BuildID -- the same gadgets either
way. Pass -f to search the file at every level.

#### Other Architectures

##### i386

!i386

##### AArch64

!aarch64

##### ARM32

##### RISC-V (RV64)

##### MIPS

Big-endian is as common as little-endian here, and both are read. This one is
OpenWrt's musl for ath79, which ships with no section headers -- the shape a
router's libc usually arrives in.

#### Combine with Script
Pass your exploit script to one_gadget and it runs the script once per gadget, so you
don't have to work through them by hand.

!--script

In Ruby Scripts

To Python Lovers

Make OneGadget Better

Please let me know if you come across a libc OneGadget finds nothing in. And if you like
this work, I'd be happy to be starred :grimacing:

项目信息

开发语言：Ruby

Star 数：2358

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕The best tool for finding one gadget RCE in libc.so.6展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。